110272 matches found
WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability
WordPress Masteriyo - LMS plugin = 3.4.0 - PHP Object Injection vulnerability discovered by 20kilograma in WordPress Plugin Masteriyo - LMS versions = 3.4.0...
WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by nh4tvd in WordPress Plugin ThemeREX Addons versions 2.45.0...
WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by LueRader in WordPress Plugin Everest Forms versions = 3.6.0...
WordPress Site Reviews plugin 7.2.2-8.2.2 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Site Reviews versions 7.2.2-8.2.2...
WordPress Weaver Show Posts plugin < 1.8.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Do Xuan Trung in WordPress Plugin Weaver Show Posts versions 1.8.1...
CVE-2026-14560 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...
AZL-101766 CVE-2026-89161 affecting package php 8.3.33-1
In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...
AZL-101760 CVE-2026-89157 affecting package php 8.3.33-1
PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...
PT-2026-90020
Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...
SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37987)
Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the improper filtering of the ID parameter in the /pages/emp Edit1.php...
CVE-2026-79362
Certain Woltlab products are vulnerable to Remote Code Execution (RCE) via Cache Poisoning in the WCF component. The vulnerability affects versions WCF >= 6.1.0 until = 6.2.0 until
CVE-2026-79362
Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...
EUVD-2026-76188
Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...
SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37983)
Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability arises from the failure of the /pages/custedit1.php file to properly validate the ID...
CVE-2026-62103: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...
CVE-2026-62107: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...
CVE-2026-62105: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...
CVE-2026-14560: Improper Control of Generation of Code
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...